A known Intrusion Prevention System (“IPS”) with a SNORT™ intrusion analysis engine or Internet Security System PAM™ intrusion analysis engine can be interposed between network segments. For example, the IPS can be installed in a firewall or gateway to a network. The IPS can analyze incoming message packets for intrusions, such as viruses and worms (“malware”), attempted exploitation of vulnerabilities such as buffer overflows, violations of network policy, and/or denial of service attacks. If the IPS detects an intrusion in a packet, the IPS can automatically block/drop the packet, block the flow associated with the packet, and/or notify an administrator. The administrator can further analyze the notification details, and if he or she determines that the notification is associated with an intrusion, may change the configuration of a firewall to block the intruder, report the event to the authorities, gather forensic evidence, clean any compromised hosts, and/or contact the administrator of the network that was the source of the attack.
Occasionally, the rate of incoming packets is greater than the IPS can process them (i.e. analyze them for intrusions). In such a case, the IPS can either drop or pass the excess packets which it cannot process. If the packet is not malicious but is dropped (without analysis) due to the overload, this may represent a loss of important data, request or other communication. If the packet is malicious but is allowed to pass through the IPS (without analysis) due to overload, this may harm a device on the destination network. To mitigate the risk, there may be a firewall between the IPS and the destination network that will block some potentially malicious packets. The firewall will block the packet if the packet does not match a permitted flow, i.e. combination of source IP address, source port, destination IP address, destination port and protocol, but may not analyze the packet for viruses or worms or detect an attempted exploitation of vulnerabilities or denial of service attack. In any event, statistically the risk of loss of important data, request or other non malicious communication may outweigh the risk that the packet being passed without analysis is malicious and the harm it will cause. Nevertheless, further steps should be taken to better manage an intrusion prevention system.
An object of the present invention is to better manage an IPS.
Another object of the present invention is to better manage an IPS in case of an overload of incoming packets.